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REMARKS 

Reconsideration of this Application is respectfully requested 

Upon entry of the foregoing amendments, claims 1,3-11 and 13-22 are pending in the 
application, with claims 1 and 1 1 being the independent claims. Claims 2 and 12 have been 
canceled without prejudice or disclaimer. Support for the subject matter of the amended claims 
is contained in the application as originally filed. Because the foregoing changes introduce no 
new matter, their entry is respectfully requested. 

Claim Objections 

Applicant respectfully requests the Examiner to withdraw his objection to claims 21 and 
22. Both claims were previously amended to remove their multiple dependencies. See First 
Preliminary Amendment, submitted December 20, 200 L 

As for the Examiner's remaining objections to claims 1-22, Applicant respectfully 
submits that the objections are overcome by the accompanying amendment thereto. 

Rejections under 35 § 112 

The Examiner has rejected claims 1-22 under 35 U-S.C. §1 12, second paragraph as being 
indefinite. Applicant respectfully submits that the rejection of claims 1-22 are overcome by the 
accompanying amendment thereto. 

Rejections under 35 UJ5.C. § 102 and 103 
Claims 1 and 11 

The Examiner has rejected claims 1 and 1 1 under 35 U.S.C. § 102 as being anticipated by 
U.S. Patent No. 5,842,002 to Schnurer et al. ("the Schnurer patent"). The Schnurer patent fails 
:o teach or suggest the method of the present invention including, inter alia, the steps of 

"analvzine and learning from the viruses by analyzing the generated 
standard samples and extracting information and knowledge on the viruses 
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i ndicated bv changes between the standard samples before infection and after 
i nfection when it is determined that said target object to be scanned contains a 
virus; and 

cleaning viruses from the infected target object by removing the virus's 
body and modifying key information which has been changed by said vims onthe 
hasis of said information and knowledge on the viruses indicated bv changes 
between the standard samples before infection and after infection and on the basis 
of the modification that viruses have made to said infected objects or baits" 

as is called for by amended claim 1 . Similarly, the Schnurer patent fails to teach or suggest the 
computer system of the present invention which includes means and a unit for performing the 
above-mentioned steps. 

The Schnurer patent instead discloses a computer virus trap for detecting computer 
viruses by providing a virtual computer environment to induce any disruptive behavior. The 
response/alarm means 52, which only makes a response or alarm can not do anything to clean the 
virus and recover the uninfected object. See column 8, lines 27-35, 50-59, FIG. 1. 

In contrast, the solution of the present invention is to obtain information and knowledge 
on the viruses because the standard samples before the infection and the standard samples after 
the infection both are known after the step of activating the target object, and the difference or 
changes between the standard samples before and after the infection are known. From this 
difference, it is assumed that the difference between the infected target object and the virus-free 
carget object is of the same type as the difference between the standard samples before and after 
the infection. Therefore, on the basis of the obtained difference between the infected samples and 
rhe non-infected samples, the invention cleans the viruses by removing the virus' body and 
modifying key information changed by the vims. In the present invention, it is not necessary to 
obtain the signature or characteristic codes of the viruses manually, so the virus cleaning step can 
be implemented by the machine automatically. 

For at least these reasons, Applicant respectfully submits that the Schnurer patent does 
not anticipate independent claims 1 and 11 . Applicant submits that claims 3-10 and 13-22, 
which depend from either claim 1 or 1 1, are allowable over the cited art for at least the same 
reasons noted above. 

\MENDMgNT AND REPLY 9 of 1 4 4852-6024-3 200\1 



PATENT 

i 



PAGE 14/19 * RCVD AT 7/29/2005 1 :34:03 PM [Eastern Daylight Time] * SVR:USPTO-EFXRF-6/25 * DNIS:2738300 * CSID:41 5 398 3249 * DURATION (mn«s):05-52 



07729/2065 10:42 FAX 415 398 3249 



DORSEY & WHITNEY LLP-SF 



0015/019 



PATENT Attorney Docket No. A-7091 5/DJB/VEJ 

Application No. 09/963,359 

Claims 2 % 12 and 18 

The Examiner has rejected claims 2, 8, 12 and 18 under 35 U,S.C. 103 as being 
unpatentable over the Schnurer patent in view of U.S. Patent No. 6,338,141 to Wells ("the Wells 
patent'*) and U.S. Patent No. 6,067,410 to Nachenberg ("the Nachenberg patent"). The 
rejections of claims 2 and 12 are rendered moot by the cancellation thereof, however, 
Applications hereby address the Examiner's rejection as similar limitations have been 
incorporated into claims 1 and 11. The Schnurer, Wells and Nachenberg patents, taken 
individually or combined, fail to teach or suggest the method of the present invention. As noted 
above, the Schnurer fails to disclose, inter alia, the steps of 

"analyzing and learning from the viruses by analyzing the generated 
standard samples and extracting information and knowledge on the viruses 
indicated bv changes between the standard samples before infection and after 
i nfection when it is determined that said target object to be scanned contains a 
virus; and 

cleaning viruses from the infected target object by removing the virus's 
body and modifying key information which has been changed by said virus on the 
basis of said information and knowledge on the viruses indicated by changes 
between the standard samples be fore infe ction and after infection and on the basis 
of the modification that viruses have made to said infected objects or baits" 

as is called for by amended claim 1 . Similarly, the Schnurer patent fails to teach or suggest the 
computer system of the present invention which includes means and a unit for performing the 
above-mentioned steps. The Wells and Nachenberg patents fail to make up for the deficiencies 
of the Schnurer patent. 

The Wells patent fails to disclose or suggest a system to detect and clean unknown 
viruses if no signature of the virus is already included in the known virus signature database. 
The Wells patent instead discloses a method for detecting and removing known viruses or 
variants of known viruses by using the combination and relationship of multiple signatures, 
signature types etc. Wells is but a traditional method for detecting and cleaning viruses by 
means of virus signature, although multiple signatures are used. In fact, the Wells patent teaches 
away from the present invention because the samples described at column 9, line 57, to 
column! 0, line 1, are not an equivalent of the "standard samples** set forth in claims 1 and 1 1 of 
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the present invention, but are actual files to be scanned. See column 9, lines 3-67 and column 10 ? 
lines 1-13. 

The Nachenberg patent likewise fails to disclose or suggest a system to remove unknown 
viruses, only known viruses. The Nachenberg patent instead provides a method to deal with 
polymorphic viruses, which are encrypted, by emulating a virtual CPU and a memory to let the 
polymorphic virus decrypted. After the decryption, the overlay modules 262 with overlay repair 
routines 264 can repair the viruses. In fact, the Nachenberg patent teaches away from the present 
invention because each overlay module 262 or overlay routine 264 is for a specific virus. It 
means each overlay module 262 or overlay routine 264 can repair a certain known vims, not an 
unknown one. See column 3 lines 42-58, FIG. 2. 

)n contrast, the solution of the present invention is not only detecting the existence of 
unknown viruses, but also cleaning and removing the unknown viruses, Although Schnurer can 
detect ujiknown viruses, as Wells and Nachenberg use conventional method to remove viruses by 
means of known virus signatures, it is non-obvious for a person skilled person to obtain the 
solution of claims 1 and 1 1 by combining Schnurer with Wells and Nachenberg. 

Although Schnurer teaches detecting viruses in a virtual computer environment;, it is not 
able to remove viruses, especially the unknown viruses. Wells uses virus signatures to detect 
known viruses, and is incapable to detect and remove unknown viruses. By combining Wells 
with Schnurer, it is impossible to remove unknown viruses because Wells can handle known 
viruses only, The step 1 Ob of analysis of Wells is 'the mode that is used to produce virus 
signatures" which collects information on the virus to be sent to a vendor's virus analysis. In 
fact, the method in Wells is still a conventional technology to detect the known viruses with 
signatures* and in case of unknown viruses, the signature and information on the virus is 
collected for fiirther use. Although Schnurer teaches detecting viruses by providing a virtual 
computer environment, as Wells still uses multiple virus signatures to detect the known viruses, 
and the leaven software in Wells is running on the actual files (not virtual files). Wells fails to 
provide an effective means to detect and remove viruses of which the signatures are unknown, 
thus there is no suggestion for Wells to be combined with Schnurer. Even by combining Wells 
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with Schnurer, it is difficult for a person skilled in the art to obtain the solution of the present 
amended claims 1 and 1 1 which provides a virtual computer environment and various standard 
samples in the virtual computer environment to induce the infection from a possible infected 
target object. In case the samples are infected, a virus is detected; and by comparing the standard 
samples before and after infection, and on the basis of the same, the virus is removed or cleaned 
from the infected target object (actual file) by making changes reverse to those between the 
standard samples before and after infection. In this way, any kind of viruses, known or unknown, 
can be detected, and in most cases, viruses including unknown viruses can be cleaned or 
removed from an infected target object, without jeopardizing the actual computer system or files. 
Therefo re, the amended claims 1 and 1 1 are non-obvious over Schnurer in light of Wells. 

Furthermore, Nachenberg is designed to deal with polymorphic viruses and it uses fixed 
overlay modules 262 each designed specifically to remove a certain virus, so it is not able to 
remove unknown viruses. Even combining Nachenberg with Schnurer and/or Wells, it is not 
obvious to obtain the solution of the amended claims 1 and 1 1 . 

For at least these reasons, Applicant respectfully submits that the Wells patent and the 
Nachenberg patent, taken individually or combined, do not anticipate or render obvious 
independent claims 1 and 1 1 . Applicant submits that claims 3-10 and 13-22, which depend from 
either claim 1 or 1 1, are allowable over the cited art for at least the same reasons noted above. 

Claims 3, 4-7, 9-10, 13-17, and 19-20 

The Examiner has rejected claims 3, 4-7, 9-10, 14-17, and 19-20 under 35 U.S.C. 103 as 
being anticipated by the Schnurer patent in view of the Wells and Nachenberg patent, and further 
in view of one or more of: the Connectix Virtual PC software by Connectix ( 4t the Connectix 
software"), U.S. Patent No. 5,832,208 to Chen ('the Chen patent") and "Thomas' NT Utility 
Disk" by Thomas Berger ('the Berger publication'*). As noted above, the Schnurer patent, the 
Wells patent, and the Nachenberg patent, taken individually or combined, fail to teach or suggest 
the method and computer system of the present invention. The Connectix software, the Chen 
patent and the Berger publication fail to account for the deficiencies of the Schnurer, Wells and 
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Nachenberg patents. In fact, the Examiner does not rely on any of these references to teach or 
suggest the steps of 

' 'analyzing and learning from the viruses by analyzing the generated standard 
samples and extracting information and knowledge on the viruses indicated by 
changes between the standard samples before infection and after infection when it 
is determined that said target object to be scanned contains a virus; and 

cleaning viruses from the infected target object by removing the virus's 
body and modifying key information which has been changed by said virus on the 
basis of said information and knowledge on the viruses indicated by changes 
between the standard samples before infection and after infection and on the basis 
of the modification that viruses have made to said infected objects or baits" 

For at least these reasons, Applicant respectfully submits that the Wells patent and the 
Nachenberg patent, taken individually or combined, in view of the Connectix software, the Chen 
patent and the Berger publication, do not render obvious independent claims 1 and 11. Applicant 
submits that claims 3, 4-7, 9-10, 13-17, and 19-20, which depend from either claim 1 or 1 1, are 
allowable over the cited art for at least the same reasons noted above. 

CONCLUSION 

All of the stated grounds of objection and rejection have been properly traversed, 
accommodated, or rendered moot. Applicant therefore respectfully requests that the Examiner 
reconsider all presently outstanding objections and rejections and that they be withdrawn. 
Applicant believes that a full and complete reply has been made to the outstanding Office Action 
and, as such, the present application is in condition for allowance. If the Examiner believes, for 
any reason, that personal communication will expedite prosecution of this application, the 
Examiner is invited to telephone the undersigned at the number provided below. 

The Commissioner is hereby authorized to charge any underpayment of fees associated 
with this communication, including any necessary fees for extension of time or additional claims, 
and/or credit any overpayment to Deposit Account No. 50-2319 (Order No. 469164-00005; 
Docket No. A-709 15/DJB/VEJ). 
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Prompt and favorable consideration of this Amendment and Response is respectfully 



requested. 



Respectfully submitted, 



Date; 




By: A 




Victor E. Johnson, Reg, No, 41,546 
Filed Under 37 C.FJL § i .34(a) 



DORSEY & WHITNEY LLP 

Suite 1000 

555 California Street 

San Francisco, California 94104-1513 

Telephone (415)781-1989 Facsimile: (415)398-3249 
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